Privacy
Privacy Policy
Last updated: September 29, 2026
The short version
- This is my personal professional website. I keep data collection light and use it to understand what's useful here.
- Analytics and marketing cookies load only after you say yes. You can change your choice anytime from Cookie settings in the footer.
- I honor Global Privacy Control and Do Not Track signals by keeping marketing cookies off.
- I don't sell personal information, and I never use it for automated decisions about you.
- Questions or requests go straight to me at my email.
Who I am
kimgiroux.com is operated by Kim Giroux, an independent marketing advisor based in California, United States. For the purposes of the EU and UK General Data Protection Regulation (GDPR), I'm the controller of the personal data described here.
You can reach me about anything in this policy at my email address.
What I collect
Information you send me
If you email me, I receive your name, email address, and whatever you choose to include in your message.
Analytics (with your consent)
If you allow analytics, Google Analytics 4 collects information about your visit: pages viewed, time on page, how you arrived (for example, a search engine or a link), approximate location at the city or country level, and device and browser type. Google Analytics 4 doesn't log or store IP addresses. I see this information in aggregate reports.
Marketing measurement (with your consent)
If you allow marketing cookies, two additional features turn on:
- LinkedIn Insight Tag. LinkedIn receives information about your visit (such as the page URL, referrer, IP address, device and browser details, and a timestamp). If you're signed in to LinkedIn, LinkedIn may connect the visit to your member account. I receive only aggregated reports, such as the job titles and industries of visitors in general, and I can use this to measure LinkedIn campaigns and build audiences for LinkedIn ads.
- Google Signals. This Google Analytics feature uses data from visitors who are signed in to Google and have enabled ad personalization to provide aggregated cross-device and demographic reports (such as age range and interest categories). I don't use Google Analytics data for advertising or remarketing.
Hosting logs
My hosting provider, Netlify, automatically processes technical information needed to deliver the site and keep it secure, including IP address, browser type, requested page, and time of request.
Your cookie choice
An essential cookie remembers the choice you make in the cookie banner so you aren't asked on every visit.
How I use it, and my legal basis
Under the GDPR, every use of personal data needs a legal basis. Here's how each one lines up:
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your messages and any work that follows | Name, email, message content | Legitimate interests (responding to you), or steps toward a contract at your request |
| Understanding how the site is used so I can improve it | Google Analytics data | Your consent |
| Measuring LinkedIn campaigns, audience demographics, and LinkedIn ad audiences | LinkedIn Insight Tag data, Google Signals data | Your consent |
| Delivering the site and keeping it secure | Hosting logs | Legitimate interests (operating a secure website) |
| Remembering your cookie choice | Consent cookie | Legal obligation and legitimate interests (keeping a record of your choice) |
Where I rely on consent, you can withdraw it anytime through Cookie settings. Withdrawing consent applies going forward.
International transfers
I'm based in the United States, and my service providers process data in the United States and elsewhere. When personal data from the EU, UK, or Switzerland is transferred to the United States, it's protected by the EU-U.S. Data Privacy Framework (and its UK Extension and Swiss counterpart) where the provider is certified, and otherwise by the European Commission's Standard Contractual Clauses or equivalent safeguards. You can ask me for more detail on these safeguards.
How long I keep it
- Emails: for as long as needed to continue our conversation and any work that follows, then deleted when no longer needed.
- Google Analytics: event-level and user-level data are kept for 2 months, after which only aggregated reports remain.
- LinkedIn Insight Tag: retained by LinkedIn under its own privacy policy. I see only aggregated data.
- Hosting logs: retained by Netlify for a limited period under its own policies.
- Consent cookie: 12 months if you accept, 6 months if you decline, after which you're asked again.
Your rights
Depending on where you live, you have rights over your personal information. If you're in the EU, UK, or Switzerland, these include the right to:
- Access the personal data I hold about you and receive a copy
- Correct inaccurate data
- Delete your data
- Restrict or object to how I use it, including any use based on legitimate interests
- Receive your data in a portable format
- Withdraw consent at any time, through Cookie settings or by contacting me
- Lodge a complaint with your local data protection authority
Because analytics and marketing data is pseudonymous and held mainly by Google and LinkedIn, I may not be able to link it to you by name. I'll always help as far as I can, and you can also use the tools those providers offer directly.
California residents
This notice is provided under the California Online Privacy Protection Act (CalOPPA) and to describe your options under California privacy law.
- Categories collected: identifiers (such as email address, IP address, and cookie IDs), internet activity (pages viewed and interactions with this site), approximate geolocation, and anything you share in a message. Sources and purposes are described above.
- Sale and sharing: I don't sell personal information. If you allow marketing cookies, the LinkedIn Insight Tag and Google Signals may count as "sharing" for cross-context behavioral advertising under California law. You can opt out anytime through Cookie settings, and this site honors Global Privacy Control as an opt-out automatically.
- Sensitive information: I don't collect sensitive personal information through this site.
- Do Not Track: this site responds to Do Not Track and Global Privacy Control signals by keeping marketing cookies off.
- Other parties' tracking: other than Google and LinkedIn as described above, no third parties collect information about your online activities over time and across websites through this site.
- Your requests: you can ask to know, correct, or delete personal information I hold about you by emailing me. I won't treat you differently for making a request.
Contact and complaints
To make a request, ask a question, or raise a concern, email me at my email address. I'll confirm receipt, may ask for information to verify your identity, and will respond within one month (30 days for UK complaints). I'll let you know if I need more time, as the law allows.
If you're not satisfied with my response, you can contact a data protection authority. In the UK, that's the Information Commissioner's Office. In the EU, you can find your national authority on the European Data Protection Board's list of members. In California, you can contact the California Privacy Protection Agency.
Other details
Security
The site is served over HTTPS, and I use reasonable safeguards to protect the information I hold. No method of transmission or storage is completely secure, so I can't guarantee absolute security.
Children
This site is intended for professionals and isn't directed to children under 16. I don't knowingly collect personal information from children.
Links to other sites
This site links to other websites, such as LinkedIn. Their privacy practices are governed by their own policies.
Changes to this policy
I'll update this policy when my practices or the law change, and I'll revise the "Last updated" date above. If a change affects what I ask your consent for, the cookie banner will ask you again.